This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/main by this push:
new cd9c9b7a4 enh(security-reports): add CVE-2026-56091 and CVE-2026-49268
vulnerability details and mitigations
cd9c9b7a4 is described below
commit cd9c9b7a4ac54ca936b0696202d9512d0621711a
Author: lprimak <[email protected]>
AuthorDate: Thu Jun 18 23:28:18 2026 -0500
enh(security-reports): add CVE-2026-56091 and CVE-2026-49268 vulnerability
details and mitigations
---
src/site/content/security-reports.adoc | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/src/site/content/security-reports.adoc
b/src/site/content/security-reports.adoc
index 45409e528..8090582e5 100644
--- a/src/site/content/security-reports.adoc
+++ b/src/site/content/security-reports.adoc
@@ -30,6 +30,27 @@ A https://www.apache.org/security/committers.html[more
detailed description of t
== Apache Shiro Vulnerability Reports
+=== link:https://www.cve.org/CVERecord?id=CVE-2026-56091[CVE-2026-56091]
+When using Apache Shiro with the `shiro-guice` module in a web servlet
context, a specially crafted HTTP request may cause an authentication bypass.
+This vulnerability is similar to
link:https://www.cve.org/CVERecord?id=CVE-2020-1957[CVE-2020-1957], except that
it affects the `shiro-guice` module instead of the `shiro-spring` module.
+This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1
only when using `shiro-guice` module in a web servlet context.
+
+**Mitigation:**
+Upgrade to version 3.0.0 or later, which fixes the issue.
+
+**Credit:**
+Apache Shiro would like to thank *LocalHost* for reporting this issue.
+
+=== link:https://www.cve.org/CVERecord?id=CVE-2026-49268[CVE-2026-49268]
+"Remember me" cookie age is not verified on the server. This potentially
allows an attacker to intercept a valid cookie and reuse it indefinitely, even
after the configured expiration time has passed.
+This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and
3.0.0-alpha-1, only when RememberMe functionality is enabled.
+
+**Mitigation:**
+Upgrade to version 3.0.0 or later, which fixes the issue.
+
+**Credit:**
+Apache Shiro would like to thank *Richard Bradley* for reporting this issue.
+
=== link:https://www.cve.org/CVERecord?id=CVE-2026-49268[CVE-2026-49268]
A remote attacker can inject LDAP special characters into the Distinguished
Name (DN) construction in `DefaultLdapRealm` class. User-supplied username
input is directly concatenated into the LDAP DN template without any escaping
of RFC 2253 special characters. This allows an attacker to manipulate the DN
structure used for LDAP bind authentication, potentially bypassing
authentication or impersonating other users.
This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1
when using `DefaultLdapRealm`.
